S3 and compatible storage

Step 1: Grant list and read access

In AWS IAM → Policies → Create policy → JSON, paste this policy. Replace example-scan-bucket and reports/ to match your bucket and prefix. Create a policy named MyrikeepReadReports. No write or delete permission is needed.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BucketProbeAndList",
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::example-scan-bucket"
    },
    {
      "Sid": "ReadSelectedPrefix",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-scan-bucket/reports/*"
    }
  ]
}

This is the list/read policy needed by the current connector. It probes the bucket with HeadBucket before listing. A prefix condition on ListBucket blocks that probe. Listing permission therefore covers object names in the bucket; object content access is restricted to reports/. Set the console prefix as well. For isolation of names and content, scan a dedicated bucket. For a whole bucket, change the object resource to arn:aws:s3:::example-scan-bucket/*. See HeadBucket permissions.

SSE-KMS objects may also require kms:Decrypt on the exact KMS key, with its key policy allowing the scan identity. Do not add broad KMS access. Compatible providers use their own bucket/key permissions; apply equivalent list and read restrictions there.

Step 2: Choose keys or workload identity

For AWS workload identity, attach this policy to the agent's instance/task role in IAM → Roles → select role → Add permissions. Select S3/Azure workload identity in Myrikeep and leave Credential name empty. The agent uses boto3's credential chain on its host. The role must be accessible inside the container. Hosted workload identity needs an operator's explicit opt-in.

For keys, create a dedicated identity in IAM → Users → Create user, without console access. Attach only this policy. Under Security credentials → Create access key, choose the use case that matches your host and copy the pair once. Use a provider-issued S3 key pair for compatible services. Temporary AWS keys also require their session token and expire; workload identity avoids manual renewal.

Step 3: Add and scan

In Connections → Add connection, choose AWS S3 bucket, enter bucket, prefix, region and optional custom endpoint, and assign your agent. Save the files below if using keys. Wait for present, then queue a scan in Scans.